# Processor 28(a) — GDPR — provision context

> Focused context for a single provision (28(a)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-28#par-3-pnt-a
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Processor** (GDPR, full article: https://overview.legal/laws/gdpr/art-28).

## Provision text

### 28(a)

processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;


## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** (guidance) — https://overview.legal/posts/125965
- **Guidelines 07/2022 on certification as a tool for transfers** (guidance) — https://overview.legal/posts/38131
- **Guidelines 02/2024 on Article 48 GDPR** (guidance) — https://overview.legal/posts/38045
- **Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)** (guidance) — https://overview.legal/posts/125715
- **Opinion 7/2024 on the draft decision of the German North Rhine Westphalia Supervisory Authority regarding the EU Cloud Service Data Protection (Auditor) certification criteria** (guidance) — https://overview.legal/posts/125759
- **Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR** (guidance) — https://overview.legal/posts/125866
- **Guidelines 02/2024 on Article 48 GDPR** (guidance) — https://overview.legal/posts/50894
- **Guidelines 07/2020 on the concepts of controller and processor in the GDPR** (guidance) — https://overview.legal/posts/38069
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** §57 (guidance, EDPB) — https://overview.legal/posts/125965
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** §42 (guidance, EDPB) — https://overview.legal/posts/125965

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-28#par-3-pnt-a · 2026-08-22